#BitcoinRalliesOver5Percent

More than US$500,000 Worth of NFTs Successfully Saved in Yuga’s White-Hat Operation

Yuga Labs successfully rescued 68 NFTs worth more than US$500,000 through an emergency white-hat action, allowing it to secure assets exposed as a result of the Flooring Protocol exploit before the attacker could drain everything.

The assets successfully rescued include 29 Bored Apes, two CryptoPunks, and four Mutant Apes; now all of those NFTs are under Yuga’s control and will be returned to their owners after the protocol has been fixed.

How the Exploit Happened

Flooring Protocol is an NFT liquidity platform. Users can lock their NFTs and receive fpToken that are tradable and pegged 1:1 to the stored NFT.

The attacker started with a small amount of Wrapped Ether (WETH), then exploited a loophole in the protocol’s accounting logic that allowed them to mint nearly unlimited fpToken balances.

According to Yuga’s blockchain VP, 0xQuit, the maliciously created token IDs created what he called a ghost ownership status. Ownership checks pass on one side, but internal records are actually different on the other, explained 0xQuit.

Next, two uncontrolled underflows occurred, causing the attacker’s balance to become extremely large. They then dumped the fpToken price until it was close to zero and drained the affected pool.

Why Yuga Jumped In

Researchers later found a second attack path that exposed pools worth more, including blue-chip NFT collections. Those NFTs survived the first attack because their pools had slightly less liquidity.

The bet was on those flagship collections. The base price of Bored Apes was around 8.95 ETH or about US$15,121, while CryptoPunks was above 32 ETH or approximately US$55,248, according to CoinGecko data as of June 8.

With those prices, 29 Bored Apes alone were worth about US$441,000, making them the largest item in the assets that were rescued.

That calculation aligns with the data of more than US$500,000 for the total 68 NFTs mentioned by 0xQuit. The exploit also took place over the weekend, when only a few teams were monitoring on-chain activity.

Flooring Protocol has been in sunset mode since last year, and its NFT division is mostly no longer managed. The original architect only remained as a liquidity provider and also lost its own assets in this incident.

CEO Michael Figge revealed that he instructed the GrailsOTC desk to release funds and NFTs for the rescue mission. The team then launched a contract that used the same bug but to defend, mimicking the white-hat recovery steps that had previously been carried out in DeFi.

Yuga, which also acquired the CryptoPunks collection, emphasized that this move is temporary. The architect, under the account name 0xFreeLunch, took responsibility and blamed gas-optimized code, which made the bug difficult for auditors to detect.

What Happens Next

The protocol architect also suspected that the attacker used advanced AI tools, given how complex the attack was. Meanwhile, Quit asked holders not to approach this platform.

“It’s very important NOT to deposit NFTs into Flooring Protocol anymore, because they could be immediately vulnerable,” Quit said.

The culprit is still holding some of the stolen NFTs, so the case is not over. Like other DeFi projects after being hit by exploits, Flooring will likely launch a new contract and must make decisions about compensation for affected holders.